Registration Lock is an optional feature (not enabled by default even if you create your Signal PIN) that prevents anyone from (re-)registering your phone number with Signal without knowing your Signal PIN. You can turn it on in your account settings.
Registration Lock is not available when you have disabled your PIN.
If PIN is forgotten, or someone gains access to your phone number[edit | edit source]
If someone gains control of your number for more than 7 days (this can happen if you no longer use the phone number, and it got re-assigned to someone else by your carrier, for example), they can wait until the lock expires and re-register without entering the PIN (this also applies if you need to re-register, but forget your PIN). This will, however:
- Erase the contacts and profile data you had previously;
- Should prevent them from accessing the groups you were in;[source needed]
- Unless they also have access to one of your devices (in order to e.g. transfer to another device, to keep the identity key), all your contacts will see a Safety Number change.
Internal details[edit | edit source]
To facilitate (the current version, v2, of) this feature, clients share the registration lock token (key which is derived from the master key[1]) with the service. During registration, after restoring the master key, clients will send the token to prove to the service that the PIN was correct.
Clients regularly contact the server to keep the Registration Lock alive, because it expires after 7 days of inactivity (linked device activity resets this timer as well).[2]
Previous versions[edit | edit source]
Registration Lock v2 (current)[edit | edit source]
Since the introduction of this version, the unregistration page on Signal's website (mentioned below in v1 history) stopped working, because it could not interact with Secure Value Recovery. The unregistration page was removed because of this.
Later, the behavior of the lock was changed to automatically unregister the previous owner, once the new owner confirmed they have access to the phone number (even if they have not entered yet, and may not ever enter, the correct Signal PIN). This restores the behavior of the unregistration page, but makes it automatic.
Registration Lock v1[edit | edit source]
Registration Lock was available before the introduction of Signal PINs and served the same purpose as the current version. You could create a PIN that was used just for Registration Lock.
- This may be incorrect, but this Registration Lock-specific PIN may have been stored in plaintext on the server.
- If you had such a Registration Lock-specific PIN set up before the introduction of Signal PINs, your PIN was automatically migrated to a Signal PIN.[3]
- If a new owner of the phone number wanted to register in Signal, they had to use a special page on Signal's website in order to unregister you (and then wait for 7 days for the lock to expire so they can register).